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Remarks/Arguments 

The Office Action mailed October 8, 2009 has been reviewed and carefully 
considered. No new matter has been added. 

Claims 1, 7, 16, 24, 28, and 32 have been amended. Claims 23, 25, 27, 29, 31, 
and 33 have been cancelled without prejudice. Claims 1, 6-9, 16, and 18-22, 24, 26, 28, 
30, 32, and 34-35 are pending in this application. Reconsideration of the above-identified 
application, in view of the above amendments and the following remarks, is respectfully 
requested. 

Claims 25, 29, and 33 stand rejected under 35 U.S.C. 1 12, second paragraph. As 
noted above, Claims 25, 29, and 33 have been cancelled. Thus, withdrawal of the rejection 
is respectfully requested. 

Claims 1, 6, 7, 26, and 30 stand rejected under 35 U.S.C. § 102(e) as being 
anticipated by U.S. Patent Publication No. 2005/0235360 to Pearson (hereinafter 
"Pearson"). Claims 8, 9, 20, 21, and 35 stand rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Pearson in view of U.S. Patent Application Publication No. 
2002/0133586 to Shanklin et al. (hereinafter "Shanklin"). Claims 16, 19, and 34 stand 
rejected under 35 U.S.C. § 103(a) as being unpatentable over Pearson in view of U.S. 
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Patent Application Publication No. 2002/0062450 to Carlson et al. (hereinafter 
"Carlson"). Claims 18 and 31-33 stand rejected 35 U.S.C. §103(a) as being unpatentable 
over Pearson and Carlson as applied to Claim 16, and further in view of U.S. Patent 
Application Publication 2002/0080784 to Krumel (hereinafter "Krumel"). Claim 22 
stands rejected under 35 U.S.C. § 103(a) as being unpatentable over Pearson and Carlson 
as applied to Claim 16, and further in view of Shanklin. Claims 23-25 and 27-29 stand 
rejected under 35 U.S.C. § 103(a) as being unpatentable over Pearson in view of Krumel 
and in view of Shanklin. 

As noted above, Claims 23, 25, 27, 29, 31, and 33 have been cancelled. 

The independent Claims currently pending are Claims 1, 7, and 16. 

It is respectfully asserted that none of the cited references, either taken singly or 
in any combination, teach or suggest the following limitations now recited in amended 
Claim 1: 

wherein each of the plurality of user discernable indicators except 
a particular one is associated with the different one of the plurality of 
classes, and the method further comprises: 

associating the particular one of the plurality of user discernable 
indicators with an affirmative status that filtering is being 
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contemporaneously performed for any of the packets that violate at least 
one of the rules; and 

in the case of the rule of at least a first class from among the 
plurality of classes being violated and a number of packets violating the 
rule of at least the first class exceeding a pre-specified threshold, 
providing a user discemable notification of the filtering being 
contemporaneously performed by triggering, concurrently with the 
triggering of the respective one of the plurality of user discemable 
indicators, the particular one of the plurality of user discemable indicators 
associated with the affirmative status that the filtering is being 
contemporaneously performed. 

Moreover, it is respectfully asserted that none of the cited references, either taken 
singly or in any combination, teach or suggest the following limitations now recited in 
amended Claim 7: 

wherein each of the plurality of user discemable indicators except 
a particular one is associated with the different one of the plurality of 
classes, and the method further comprises: 

associating the particular one of the plurality of user discemable 
indicators with an affirmative status that filtering is being 
contemporaneously performed for any of the packets that violate at least 
one of the rules; and 

in the case of the rule of at least a first class from among the 
plurality of classes being violated and a number of packets violating the 
rule of at least the first class exceeding a pre-specified threshold, 
providing a user discemable notification of the filtering being 
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contemporaneously performed by triggering, concurrently with the 
triggering of the respective one of the plurality of user discernable 
indicators, the particular one of the plurality of user discernable indicators 
associated with the affirmative status that the filtering is being 
contemporaneously performed. 

Further, it is respectfully asserted that none of the cited references, either taken 
singly or in any combination, teach or suggest the following limitations now recited in 
amended Claim 16: 

wherein the firewall program is executable by said controller to 
cause filtering any of the packets that at least one of the rules, and wherein 
each of the plurality of user discernable indicators other than a particular 
one is respectively associated with the different ones of the plurality of 
classes, the particular one of the plurality of user discernable indicators 
being associated with an affirmative status that filtering is being 
contemporaneously performed, and wherein the particular one of the 
plurality of user discernable indicators is triggered, concurrently with the 
triggering of the respective one of the plurality of user discernable 
indicators, if the one or more of the rules is violated, the filtering is 
performed by the firewall program, and a number of the packets that 
violate the one or more rules exceeds a pre-specified threshold. 

It is to be noted that each of Claims 1, 7, and 16 have been amended to now recite 
that each of the plurality of user discernable indicators are visually discernable. 
Moreover, it is also to be noted that Claims 1, 7, and 16 have been amended to also now 
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include the limitations of cancelled Claims 23, 27, and 31, respectively. Accordingly, it 
is further noted that the Examiner stated the following on pages 12-13 of the pending 
Office Action in support of his rejection of Claim 23, while explicitly relying upon the 
same for his rejections of Claims 27 and 31: 

As per claims 23, Examiner incorporates the rationale for 
combining the indicator of filtering as taught by Krumel and supplied in 
the rejection of claim 18. Examiner also incorporates the rationale for 
combining the thresholds as taught by Shanklin and supplied in the 
rejection of claim 8. Pearson is silent in explicitly teaching the 
combination of indicators and function as described in claim 23. Having 
various indicators to show that filtering is done is clearly taught by 
Krumel. Krumel also teaches that LEDs can differentiate between heavy 
attacks and irregular attacks (0016). This notion meshes well with 
Shanklin' s teachings. A heavy attach must be defined by some inherent 
threshold. Examiner finds that in view of these three references that 
associating a certain event to certain LEDs and its underlying meaning as 
recited in claim 223 is simply a design choice. The claim would have 
been obvious because one of ordinary skill in the art could have 
envisioned and used LEDs to indicate many types of scenarios including 
these explicitly described in claim 23 to provide the user with feedback of 
what the cable modem is doing. Obviously the more LEDs one uses, the 
more information can be provided to the user. Krumel explicitly teaches 
many indicator scenarios. Examiner finds no particular use of the 
indicators of claim 23 to be non-obvious given the teachings of Krumel, 
Shanklin, and Pearson. 
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Office Action Dated: October 8, 2009 

The Applicants respectfully disagree with the Examiner's position. 

For example, paragraph [0116] of Krumel discloses the following in its entirety: 

In the preferred embodiment, parallel to server mode button 200 on 
the external side of the case is alert button 204, which contains alert LED 
206. Alert LED 206 is coupled to alarm controller 53 (as illustrated in 
FIG. 3), which preferably is implemented as a part of PLD 162 (as 
illustrated in FIG. 9). Alert LED 206 may contain a single or multi-colored 
LED, which, when illuminated, indicates the data protection system is 
under attack and is rejecting suspect packets. The data protection system 
preferably registers the frequency of attacks and sends signals to alert 
LED 206 based on such information. In a preferred embodiment, alert 
LED 206 may contain a LED (e.g., red), which remains consistently 
illuminated during irregular attacks or blinks at regular intervals under 
heavy attack. In another preferred embodiment, alert LED 206 may 
contain a multi-colored LED, which similarly indicates when the system is 
under attack and is rejecting packets. With a multi-colored LED, the 
increase in frequency or intervals of attacks may be indicated by a change 
in color: for example, green (indicating no registered attacks by suspect 
packets) to yellow (indicating a few irregular attacks) to red (indicating 
more frequent attacks) to blinking red (indicating a heavy attack). The 
alert alarm may be reset by depressing alert button 204. 

As is evident, paragraph [0116] of Krumel is simply directed to the active use 
(triggering) of only one indicator at any given time. For example, the preceding portion 
of Krumel discloses "LED 206 may contain a single or multi-colored LED, which, when 
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illuminated, indicates the data protection system is under attack and is rejecting suspect 
packets." However, that same LED 206 may remain consistently illuminated during 
irregular attacks or blinks under heavy attack as further disclosed therein. Moreover, in 
the case of a multi-colored LED (noting that Krumel explicitly uses the singular form of 
the word LED when describing his "multi-colored LED", and also noting that Krumel 
uses the words "change in color" versus "change in LED"), "the increase in frequency or 
intervals of attacks may be indicated by a change in color" (emphasis added). Hence, as 
per paragraph [0116] of Krumel, the same LED is always used. 

The Examiner also cited paragraph [01 17] of Krumel, which is reproduced in its 
entirety as follows: 

In a preferred embodiment, speaker 55 (or some form of audio 
transducer) may be coupled to alarm controller 53 to also indicate the 
presence or severity of attacks (as described in connection with FIG. 3). 
For example, when the data protection system is under heavy attack and 
alert LED 206 is blinking (e.g., red), an alarm signal may be transmitted to 
speaker 55 to emit audio information to indicate a suspected severe attack 
or emergency. Alarm-type information may also be coupled to the internal 
network (such as via a UDP packet, as described elsewhere herein), and 
thus transmit alarm information over the network to a software interface 
on the desktop. In other embodiments of the data protection system, an 
array of different features, including buttons, LEDs, alarms, and graphical 
user interfaces, may be utilized to indicate the class, frequency and 
severity of attacks on the system. 
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While paragraph [0117] of Kmmel mentions the concurrent use of a speaker 55 
with the triggering of LED 206, a speaker is not visually discernable in contrast to the 
indicators explicitly recited in Claims 1, 7, and 16. Advantages of using two visually 
discernable indicators (i.e., the recited "respective" and "particular" indicators of Claims 
1,7, and 16) include but are not limited to avoiding the need for the integration of 
another type of indicator and the avoidable (e.g., if a visually discernable indicator is 
used as claimed) disruption of others proximate to the user when a speaker alarm is 
triggered. Moreover, in any event, despite the Examiner asserting that "Krumel explicitly 
teaches many indicator scenarios", it is clear that Krumel does not disclose the specific 
indicator "scenario" explicitly recited in Claims 1, 7, and 16. 

Hence, Krumel does not disclose the above reproduced limitations of Claims 1, 7, 
and 16 for at least the reasons set forth above. Moreover, it is respectfully asserted that 
none of the remaining references cure the deficiencies of Krumel, and are silent with 
respect to the above reproduced limitations of Claims 1, 7, and 16. 

The failure of an asserted combination to teach or suggest each and every feature 
of a claim remains fatal to an obviousness rejection under 35 U.S.C. § 103. Section 
2143.03 of the MPEP requires the "consideration" of every claim feature in an 
obviousness determination. To render a claim unpatentable, however, the Office must do 
more than merely "consider" each and every feature for this claim. Instead, the asserted 
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combination of the patents must also teach or suggest each and every claim feature. See 
In re Royka, 490 F.2d 981, 180 USPQ 580 (CCPA 1974) (emphasis added) (to establish 
prima facie obviousness of a claimed invention, all the claim features must be taught or 
suggested by the prior art). Indeed, as the Board of Patent Appeal and Interferences has 
recently confirmed, a proper obviousness determination requires that an Examiner make 
"a searching comparison of the claimed invention - including all its limitations - with the 
teaching of the prior art." See In re Wada and Murphy, Appeal 2007-3733, citing In re 
Ochiai, 71 F.3d 1565, 1572 (Fed. Cir. 1995) (emphasis in original). "If an independent 
claim is nonobvious under 35 U.S.C. 103, then any claim depending therefrom is 
nonobvious" (MPEP §2143.03, citing In re Fine, 837 F.2d 1071, 5 USPQ2d 1596 (Fed. 
Cir. 1988)). 

Claims 6, 20, 24, 26, and 35 directly depend from Claim 1, and thus include all 
the limitations of Claim 1. Claims 8, 9, 21, 28, and 30 directly depend from Claim 7, and 
thus include all the limitations of Claim 7. Claims 18, 19, 22, 32, and 34 directly depend 
from Claim 16, and thus include all the limitations of Claim 16. Accordingly, Claims 6, 
20, 24, 26, and 35 are patentably distinct and non-obvious over the cited references for at 
least the reasons set forth above with respect to Claim 1, Claims 8, 9, 21, 28, and 30 are 
patentably distinct and non-obvious over the cited references for at least the reasons set 
forth above with respect to Claim 7, and Claims 18, 19, 22, 32, and 34 are patentably 
distinct and non-obvious over the cited references for at least the reasons set forth above 
with respect to Claim 16. 
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Thus, reconsideration of the above rejections is respectfully requested. 

In view of the foregoing, Applicants respectfully request that the rejection s of the 
claims set forth in the Office Action of October 8, 2009 be withdrawn and that the pending 
claims be allowed. 

It is believed that no further additional fees or charges are currently due. 
However, in the event that any additional fees or charges are required at this time in 
connection with the application, they are authorized and may be charged to applicants' 
Deposit Account No. 07-0832. 



Respectfully submitted, 



By: /Guy H. Eriksen/ 

Guy H. Eriksen, Attorney for Applicants 
Registration No.: 41,736 
(609) 734-6807 

Patent Operations 
Thomson Licensing Inc. 
P.O. Box 5312 
Princeton, NJ 08543-5312 

Date: October 27, 2009 
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